[Bug 31579] Microsoft Visio 2007 crashes on exit (unload of msctf component with ThreadMgr/CBT hook still alive)

https://bugs.winehq.org/show_bug.cgi?id=31579

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
                 CC|                            |[e-mail]
            Summary|Error when close Microsoft  |Microsoft Visio 2007
                   |Visio 2007                  |crashes on exit (unload of
                   |                            |msctf component with
                   |                            |ThreadMgr/CBT hook still
                   |                            |alive)
     Ever confirmed|0                           |1

--- Comment #1 from Anastasius Focht  ---
Hello folks,

confirming, still present.

Reproduce with:

1. start Visio 2007
2. open a drawing, change something
3. exit Visio -> it will ask for save the modified drawing
4. click save/overwrite existing drawing
5. after all windows disappeared a crash dialog is shown (drwatson).

On Visio shutdown there is a call to CoFreeUnusedLibraries() which unloads
Wine's 'msctf' (cf ref count == 0) but the CBT hook installed by
ThreadMgr_AssociateFocus is still alive.
During further window destruction the hook is called but the PE module is no
longer mapped in memory.

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files/Microsoft Office/Office12

$ WINEDEBUG=+tid,+seh,+relay,+msctf,+hook,+win wine ./VISIO.exe >>log.txt 2>&1
...
0023:Call KERNEL32.LoadLibraryExW(0033efce
L"C:\windows\system32\msctf.dll",00000000,00000008) ret=7e24a673
0023:Call PE DLL (proc=0x7d9cc76c,module=0x7d9b0000
L"msctf.dll",reason=PROCESS_ATTACH,res=(nil))
0023:trace:msctf:DllMain 0x7d9b0000 0x1 (nil)
...
0023:Ret  PE DLL (proc=0x7d9cc76c,module=0x7d9b0000
L"msctf.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1
0023:Ret  KERNEL32.LoadLibraryExW() retval=7d9b0000 ret=7e24a673 
...
0023:trace:msctf:ClassFactory_Constructor Created class factory 0x18b028 
...
0023:trace:msctf:ClassFactory_CreateInstance (0x18b028, (nil),
{aa80e801-2021-11d2-93e0-0060b067b86e}, 0x45f212) 
...
0023:trace:msctf:CompartmentMgr_Constructor returning 0x18b320
0023:trace:msctf:ThreadMgr_Constructor returning 0x18b040
0023:trace:msctf:ClassFactory_Destructor Destroying class factory 0x18b028 
...
0023:Ret  ole32.CoCreateInstance() retval=00000000 ret=60020b98 
0023:warn:msctf:ThreadMgr_QueryInterface unsupported interface:
{e19c7100-9709-4db7-9373-e7b518b47086}
0023:trace:msctf:ThreadMgr_fnActivate (0x18b040) 0x45f222 
..
0023:trace:msctf:ThreadMgr_CreateDocumentMgr (0x18b040) 
...
0023:trace:msctf:CompartmentMgr_Constructor returning 0x1326f80
0023:trace:msctf:DocumentMgr_Constructor returning 0x246f300
0023:trace:msctf:ThreadMgr_AssociateFocus (0x18b040) 0x4019e 0x246f300 0x32fc60
...
0023:Call user32.GetFocus() ret=7d9c9af3
0023:Ret  user32.GetFocus() retval=000900d2 ret=7d9c9af3
0023:Call user32.SetWindowsHookExW(00000005,7d9c96b5,00000000,00000023)
ret=7d9c98d5
0023:trace:hook:set_windows_hook WH_CBT 0x7d9c96b5 23 -> 0x101a2
0023:Ret  user32.SetWindowsHookExW() retval=000101a2 ret=7d9c98d5 
...
0023:Call user32.CreateWindowExA(00000080,3348ffb8
"_sdm_Mso96",00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000)
ret=326183ba
0023:trace:win:WIN_CreateWindowEx (null) L"_sdm_Mso96" ex=00000080
style=80000000 0,0 0x0 parent=(nil) menu=(nil) inst=0x400000 params=(nil)
0023:trace:win:dump_window_styles style: WS_POPUP
0023:trace:win:dump_window_styles exstyle: WS_EX_TOOLWINDOW
0023:trace:hook:call_hook calling hook 0x7d9c96b5 WH_CBT code 3 wp 101a4 lp
330014 module L""
0023:Call hook proc 0x7d9c96b5 (id=WH_CBT,code=3,wp=000101a4,lp=00330014)
0023:Call user32.CallNextHookEx(000101a2,00000003,000101a4,0032fad8)
ret=7d9c9877 
...
0023:trace:msctf:ThreadMgr_fnDeactivate (0x18b040)
0023:trace:msctf:ThreadMgrEventSink_OnSetFocus (0x18b040) (nil) 0x131d770
0023:trace:msctf:DocumentMgr_Destructor destroying 0x131d770
0023:trace:msctf:TF_GetThreadMgr  
...
0023:Call ole32.CoFreeUnusedLibraries() ret=650f8e2c
0023:Call msctf.DllCanUnloadNow() ret=7e24c16b
0023:Ret  msctf.DllCanUnloadNow() retval=00000000 ret=7e24c16b
0023:Call KERNEL32.FreeLibrary(7d9b0000) ret=7e24a9ea
0023:Call PE DLL (proc=0x7d9cc76c,module=0x7d9b0000
L"msctf.dll",reason=PROCESS_DETACH,res=(nil))
0023:trace:msctf:DllMain 0x7d9b0000 0x0 (nil)
...
0023:Ret  PE DLL (proc=0x7d9cc76c,module=0x7d9b0000
L"msctf.dll",reason=PROCESS_DETACH,res=(nil)) retval=1
0023:Ret  KERNEL32.FreeLibrary() retval=00000001 ret=7e24a9ea 
...
0023:Call user32.SetWindowLongA(000100a6,00000000,00000000) ret=326fe125
0023:trace:win:WIN_SetWindowLong 0x100a6 0 0 A
0023:Ret  user32.SetWindowLongA() retval=003f00a0 ret=326fe125
0023:Call user32.DestroyWindow(000100a6) ret=326fe133
0023:trace:win:DestroyWindow (0x100a6)
0023:trace:hook:call_hook calling hook 0x7d9c96b5 WH_CBT code 4 wp 100a6 lp 0
module L""
0023:Call hook proc 0x7d9c96b5 (id=WH_CBT,code=4,wp=000100a6,lp=00000000)
0023:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7d9c96b5
ip=7d9c96b5 tid=0023
0023:trace:seh:raise_exception  info[0]=00000000
0023:trace:seh:raise_exception  info[1]=7d9c96b5
0023:trace:seh:raise_exception  eax=7d9c96b5 ebx=7eb4d000 ecx=00000000
edx=7bcecb01 esi=00000001 edi=0033fc44
0023:trace:seh:raise_exception  ebp=0033f848 esp=0033f80c cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00210202
0023:trace:seh:call_stack_handlers calling handler at 0x608096d0 code=c0000005
flags=0 
--- snip ---

$ wine --version
wine-1.7.11-206-g82b3813

Regards